application of some new fast monte carlo methods to an

20e Congrès de maîtrise des risques et de sûreté de fonctionnement - Saint-Malo 11-13 octobre 2016

APPLICATION DE NOUVELLES METHODES ACCELEREES DE MONTE CARLOA UN CAS INDUSTRIEL

APPLICATION OF SOME NEW FAST MONTE CARLO METHODS TO AN INDUSTRIAL CASE

M. Estécahandy and S. Collas L. Bordes and C. ParoissinTOTAL EP Université de Pau et des Pays de l'AdourCSTJF IPRA/LMA, UMR CNRS 5142Avenue Larribau Avenue de l'Université64000 Pau, France 64013 Pau, [email protected] [email protected]@total.com [email protected]

Résumé

De nouvelles méthodes efficaces pour l’estimation de l’indisponibilité d’un système réparable et hautement fiable ont été proposées récemment (Estécahandy et al., 2015; Estécahandy et al., 2016; Estécahandy, 2016). Dans cette communication, nous présentons comment il est possible de combiner plusieurs de ces méthodes pour un cas proche des études de sûreté effectuées dans le domaine pétrolier. Après avoir introduit la problématique, nous présentons un système instrumenté de sécurité qui est l'une des ultimes barrières de sécurité face à des événements catastrophiques survenant sur une installation industrielle. Nous expliquons ensuite comment peuvent être combinés les différentes méthodes d’estimation basées sur la simulation d’événements rares. Enfin, nous comparons les résultats obtenus en appliquant ces méthodes avec ceux obtenus par le logiciel GRIF. A travers cet exemple numérique, nous montrons l’intérêt de ces nouvelles méthodes pour l’étude de cas industriels.

Summary

Some new efficient methods to estimate the unavailability of a repairable and highly reliable system have been recently proposed (Estécahandy et al., 2015; Estécahandy et al., 2016; Estécahandy, 2016). In this communication, we show how it is possible to combine these methods for a case close to the safety studies in the area of oil and gas industry. After introducing the problem and the context, we provide some details on High Integrity Protection System (HIPS), which is one of the ultimate safety barrier against catastrophic events on industrial installations. Next we explain how can be used these new methodsbased on the simulation of rare events. At last, we compare the results obtained when applying these methods with what can beproduced by the software GRIF. Through this numerical example, we show the interest of these new methods for the study of industrial cases.

Communication 7E-2 /1 page 1/6

mailto:[email protected]





1 Introduction In oil and gas industry, the dependability analysis of instrumented safety systems is an important industrial concern. The study of such equipment becomes more and more complicated mainly because of the progress of their operating context. Henceforth, these facilities are more and more often in offshore environment. This implies to set up more sophisticated maintenance policies to reduce risks and limit the cost of such interventions. For instance, the repair may only be allowed as soon as two failures are detected. Therefore, this generates dependency between components. It follows that the main method used in the case of safety studies, namely Fault tree (IEC 61025, 2006), is no more valid. Another approach more appropriate could be to use multi-phase Markovian processes (IEC 61165, 2006). Nonetheless, this technique is not well-suited to model, for instance, the aging process of the components with a Weibull distribution and can lead to an explosion of the state numbers. Thus, an alternative proposed and used by Total consists in employing Petri nets (IEC 62551, 2012; Signoret et al., 2008) to model as close as possible to the reality these safety systems. Furthermore, since traditional analytic or numerical methods employed for analyzing the performance of these reliable systems are difficult to apply, or even no more valid, the Monte Carlo simulation is chosen to estimate the required dependability indicators. This association is made within the engine MOCA-RP of the software GRIF (TOTAL, 2014) developed by Total. However, the considered instrumented safety systems have to be very reliable, especially to fulfill their safety function, thereby their failure are rare. Then, the Monte Carlo simulation presents the following drawback, obtaining accurate estimators on rare events require to run a large number of simulations, which incurs very long computing times. To address this issue, we have recently proposed various acceleration Monte Carlo methods in the previous works (Estécahandy et al., 2015; Estécahandy et al., 2016; Estécahandy, 2016) and assessed their performance through numerous numerical sensitivity studies together with benchmark experiments. These different analyses have allowed us to highlight the main features of our fast Monte Carlo simulation methods, such as their overall behavior, their robustness to various parameters, and the cases where they turn out to be the more relevant. In this paper, we thus propose to observe their efficiency on an industrial case. The industrial case considered here represents a High Integrity Protection System (HIPS). We study the performance of the suggested methods not only to estimate PFD(t), but also to approximate the indicator PFDavg(t) which is of more interest in the case of safety studies. The type of acceleration methods to be used among the designed ones is adapted to each subsystem of the HIPS. The choice is supported by the conclusions drawn in previous works according to the type of structure of components, so that to meet the needs of the different configurations of each sub-entity. The data set employed is artificial but close to the real data provided in OREDA (TOTAL, 2015). We perform sensitivity studies with respect to the number of simulations. In addition, our approach permits to adjust the number of simulations to be performed by subsystem. Such a strategy is useful to analyze the dependence of the global acceleration of the system to the one carried out on each sub-entity. To go further and by way of putting in perspective our works, we also present additional comparison numerical results between our fast MC method and the estimation of PFDavg(t) obtained from MOCA-RP based on the Monte Carlo simulation. This paper is organized as follows. In Section 2, we introduce the configuration of the considered HIPS. Then, in Section 3, we describe the procedure employed to deal with this system. In Section 4, we present a comparison between the results obtained from MOCA-RP and those achieved with our acceleration technique that showcases its salient features and performance. Finally, we draw our conclusions in Section 5.

2 HIPS design Let us consider a High Integrity Protection System (HIPS) which is able to protect a separator from overflow. It is composed of: - 4 level sensors (LT) that detect the high level of liquid in the separator; - 1 logic solver (LS) which processes the input from the sensors to output to the valves; - 2 valves (VA) that insulate the separator from the source of pressure.

Figure 1. Schematic HIPS



Figure 1 illustrates the structure of the studied HIPS. More precisely, the four sensors are connected to the logic solver, which is linked to the two valves. Based on 2-out-of-4 redundancy, the logic solver decides, whether or not to activate the valves which are in 1-out-of-2. Each equipment can be subject to a hidden failure which is detected during inspections and then, it is fixed by repair teams according to the setting given in Table 1. The sensors share the same repair team, which fixes the equipment after two detected failures. The two valves have also the same repair team, and one repair team is dedicated to the logic solver.

Component

Failure Detection Repair

Distribution Parameter Frequency inspection Distribution Parameter

Sensor Exponential 3 x 10-6 4,380 h Exponential 0.33

Logic solver Exponential 1 x 10-9 4,380 h Dirac 0

Valve Exponential 5 x 10-7 4,380 h Exponential 0.125

Table 1. HIPS - Data set To sum up, this HIPS is composed of three independent subsystems (SS) in series. The first subsystem SS1 is made up of fours sensors in parallel with functional dependence, the second SS2 corresponds to the logic solver and the last one SS3 consists of two valves in parallel with functional dependence too. Note that we do not consider common cause failures in this industrial case since, first, this characteristic is not systematically taken into account in safety studies and, second, it increases the HIPS unavailability and the aim of this work concerns rare event simulation.

3 Procedure In this section, we describe the acceleration procedure implemented to estimate the dependability indicators PFD(t) and PFDavg(t) of the system. The idea of accelerate methods is to make event less rare when simulating and then correcting it to recover an estimation of the rare event probability. Most of the methods in the literature deal with reliability indicator, for a non-repairable and Markovian system, in general. In Estécahandy et al. (2015) and in Estécahandy (2016), we aim at providing methods in the case of the unavailability indicator, for a repairable and non-Markovian system. Since the HIPS is made up of subsystems with various configurations, we adapt the acceleration methods to be applied to each one of the sub-entities. The appropriate choice is based upon the conclusions of effectiveness drawn in previous works: Extension of “Méthode de Conditionnement Temporel” (EMCT) has been introduced in Estécahandy et al. (2015) and Truncated Fixed-Effort Method (TFEM) in Estécahandy et al. (2016). It has been observed EMCT is efficient for one single component and for series system, while TFEM is especially efficient when components are dependent. At last, in Estécahandy (2016), random quasi Monte Carlo (RQMC) and Fixed-Effort Method (FEM) has been considered. The standard MC methods corresponding to each subsystem are denoted by MCSSi, for i=1, 2 and 3, and the global standard Monte Carlo method by MC. As regards the fast Monte Carlo methods, they are denoted by MCacc,SSi, for i = 1, 2 and 3, and the global acceleration method resulting from the three latter is then referred to MCacc. We propose to consider the following choice: - MCacc,SS1: RQMC+FEM, as the system has dependencies in 2-out-of-4; - MCacc,SS2: RQMC+EMCT, given that this is a single component; - MCacc,SS3: RQMC+EMCT, since the components have dependent rare direct failures and are in 1-out-of-2. It should be noted that we employ FEM and not TFEM in this industrial case since the intermediate events are rare enough and do not need to be truncated. From the aforementioned considerations, the subsystems are thus studied independently and sequentially in the case of Mcacc. Then, in order to find the estimators evaluating the performance of the HIPS, we combine the independent estimators associated with the subsystems, denoted by 𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡) (i = 1, 2 and 3), to the structure function of the global system. It follows that we have, for all 𝑡𝑡 ∈ ℝ+

∗ :

𝑃𝑃𝑃𝑃𝑃𝑃�(𝑡𝑡) = 1 −� �1− 𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡)�𝑚𝑚

𝑆𝑆=1

and,

var(𝑃𝑃𝑃𝑃𝑃𝑃� (𝑡𝑡)) = �� var�𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡)� + 1 − 2E �𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡)� + E �𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡)�2�var �𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡)�

𝑆𝑆−1

𝑆𝑆=1

𝑚𝑚

𝑆𝑆=1

× � �1− 2E �𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡)� + E �𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡)�2�

𝑚𝑚

𝑆𝑆=𝑆𝑆+1

where ∏ •0𝑆𝑆=1 ∶= 1 and ∏ •𝑚𝑚

𝑆𝑆=𝑚𝑚+1 ∶= 1. Similar expressions hold for the analysis of PFDavg(t), by replacing PFD(t) and 𝑃𝑃𝑃𝑃𝑃𝑃�𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡) with PFDavg(t) and 𝑃𝑃𝑃𝑃𝑃𝑃�𝑎𝑎𝑎𝑎𝑎𝑎,𝑆𝑆𝑆𝑆𝑆𝑆(𝑡𝑡), for all i = 1,2 and 3.



4 Comparison with the module Petri The module Petri of the dependability software GRIF is a tool which permits to model a system in Petri Nets and to assess its performance thanks to its engine MOCA-RP based on the standard Monte Carlo simulation. We perform in this section the safety study related to the industrial case introduced above. Then, we intend to draw some elements of comparison between the obtained results and those carried out with our acceleration method.

4.1 Modeling in Petri Nets First, we model the system thanks to the modeling language Petri Nets. The resulting graph is represented in Figure 2. In the first subsystem SS1, we find the four sensors. They share the same repair team given by the place number 17 (located below the sensors), which fixes equipment after two detected failures. Such a condition is managed by means of an additional Petri Nets next to the place number 17. The latter is taken into account through the variable RepairSensors which takes True as soon as 2 sensors are in revealed failure (NumberRevealedFailuresSensors>1) and becomes False again when there is no sensor in revealed failure (NumberRevealedFailuresSensors=0). Then, we depict independently SS2 which corresponds to the logic solver. Finally, in SS3, there are the two valves which share the same repair team symbolized by the place number 26.

Figure 2. HIPS – Petri modeling 4.2 Estimation of PFDavg(t) with MOCA-RP Once modeled, our aim is to analyse the HIPS performance as in functional safety studies. More specifically, we want to estimate its PFDavg(t), which permits to determine its so-called Safety Integrity Level (SIL) (Bently Nevada, 2002). The SIL quantifies safety in programmable electronic safety-related systems. This measure of the safety of a given process is assigned on a scale ranging from 1 to 4, the latter value being the maximum integrity level. To that effect, we first need to define the state of the system in terms of the elements of the Petri Net. The places of the HIPS are denoted by i for i=1, ..., 30 (see Figure 2). The state of the various elements of the system is then symbolized by the marking of these places. The number of tokens in the place i are given by the following numbering \#i. Thus, we describe the states of the three subsystems of the HIPS in the following way: - XSS1 = { \#2+\#3+\#4+\#6+\#7+\#8+\#10+\#11+\#12+\#14+\#15+\#16>2 } represents the state of SS1. Since the sensors are in 2-out-of-4, this variable is equal to 1 when at least 3 sensors on 4 are in failure and 0 otherwise; - XSS2 = { \#21 } stands for the state of SS2, it equals 1 if the logic solver is down, 0 otherwise; - XSS3 = { \#23+\#24+\#25+\#28+\#29+\#30=2 } corresponds to the state of the two valves in 1-out-of-2. Hence, XSS3=1 if the two valves are down, and 0 otherwise.



Let us denote by X the system variable representing the state of the global system. Then, it can be expressed as follows X= max ( XSS1, XSS2, XSS3 )

where the operator max allows to consider the three subsystems in series. Thus, let Z(s)=X, if at least one of the subsystems

among the three is down (Z(s)=1), the system is unavailable, else the system ensures its safety function (Z(s)=0).

Consequently, in order to obtain an estimation of PFDavg(t) for this system, we observe the mean of Z(s) on [0,t] that is

1𝑡𝑡�𝑍𝑍(𝑠𝑠)𝑑𝑑𝑠𝑠𝑡𝑡

0

4.3 Numerical experiment Here, we study the performance of MOCA-RP which uses the standard Monte Carlo to estimate PFDavg(t). We assess its robustness with respect to the number of simulations n. To this end, n varies in the set {1000; 10000; 100000; 1000000; 10000000; 100000000; 1000000000}. We observe 𝑃𝑃𝑃𝑃𝑃𝑃�𝑎𝑎𝑎𝑎𝑎𝑎(𝑡𝑡), its estimated empirical denoted by 𝜎𝜎��𝑃𝑃𝑃𝑃𝑃𝑃�𝑎𝑎𝑎𝑎𝑎𝑎(𝑡𝑡)� and the computing time d. It is worth mentioning that MOCA-RP is an industrial software that benefits from an important and competitive program optimization, whereas our algorithms implemented within R do not and cannot claim to be as efficient. Thus, we only intend here to draw some points of comparison between the results provided by MOCA-RP and those obtained from our fast MC method. The results from Petri are reported in Table 2. The following observations are noteworthy. - First, it should be noted that the seed of the pseudo-random generator is not the same in MOCA-RP as in R, which explains the difference between the estimators 𝑃𝑃𝑃𝑃𝑃𝑃�𝑎𝑎𝑎𝑎𝑎𝑎(𝑡𝑡) in the two tables obtained from the same standard Monte Carlo method. In addition, the programming language also differs in the two software, since MOCA-RP is based on C which is a compiled language whereas R is an interpreted one. This accounts for the fact that the computing times are not either similar for MC with the two programs. - Second, as can be seen from both Tables 2 and 3, we can note that the code of MOCA-RP is really more efficient in terms of computing time than our programs. Indeed, it is able to run 10,000,000 Monte Carlo simulations in 8 minutes, when R requires 74 hours. This is due to the previously mentioned optimization of Petri, so that our R programs are more time-consuming. - Third, the absence of optimization of our algorithms should not call into question the efficiency of our mathematical methods. Indeed, an implementation of MCacc within MOCA-RP would enjoy the same optimization as MC. Therefore, the gain in performance observed from R between MC and MCacc should be of the same order in MOCA-RP. - Finally, it is worth mentioning that, although MCacc is implemented in a less efficient computing language than Petri, this mathematical method seems to provide relevant results according to Tables 2 and 3. Indeed, MCacc exhibits with only n=10000000 simulations and less than 7 hours an accuracy level of 10-8 equivalent to the one achieved by Petri with 100 times more simulations (n=1000000000) and twice as much time (14 hours). Furthermore, from additional experiments (see Estécahandy, 2016), we have noticed that we can reduce by half the computing time of MCacc by adapting the number of simulations to be performed by subsystem. Therefore, when looking results obtained from additional numerical experiments, we can draw the following salient feature of our fast MC method. Without any program optimization, for a prescribed level of accuracy, the computing time of MCacc turns out to amount to only 25% of the one required by Petri.

PFDavg(8760) = 1.02 x 10-5

n Method 𝑃𝑃𝑃𝑃𝑃𝑃�𝑎𝑎𝑎𝑎𝑎𝑎(8760) 𝜎𝜎� �𝑃𝑃𝑃𝑃𝑃𝑃�𝑎𝑎𝑎𝑎𝑎𝑎(8760)� d (h : m : s : ms)

1000 MC 0 0 00 : 00 : 00 : 90

MCacc 3.78 x 10-6 7.98 x 10-8 00 : 00 : 01 : 47 10000 MC 3.45 x 10-5 2.89 x 10-5 00 : 00 : 08 : 17

MCacc 1.16 x 10-5 3.24 x 10-6 00 : 00 : 17 : 84 100000 MC 1.52 x 10-5 7.07 x 10-6 00 : 02 : 07 : 00

MCacc 1.12 x 10-5 4.88 x 10-7 00 : 03 : 08 : 00 1000000 MC 1.07 x 10-5 1.75 x 10-6 01 : 02 : 14 : 00

MCacc 1.03 x 10-5 1.46 x 10-7 00 : 33 : 14 : 00 10000000 MC 1.04 x 10-5 5.14 x 10-5 74 : 34 : 00 : 00

MCacc 1.02 x 10-5 3.94 x 10-8 06 : 28 : 23 : 00

Table 2. Estimation of PFDavg(8760) with R



PFDavg(8760) = 1.02 x 10-5

n Method 𝑃𝑃𝑃𝑃𝑃𝑃�𝑎𝑎𝑎𝑎𝑎𝑎(8760) 𝜎𝜎� �𝑃𝑃𝑃𝑃𝑃𝑃�𝑎𝑎𝑎𝑎𝑎𝑎(8760)� d (h : m : s : ms)

1000 MC 0 0 00 : 00 : 00 : 05 10000 MC 3.99 x 10-5 2.92 x 10-5 00 : 00 : 00 : 54 100000 MC 1.79 x 10-5 6.68 x 10-6 00 : 00 : 05 : 35 1000000 MC 1.32 x 10-5 1.86 x 10-6 00 : 00 : 51 : 73 10000000 MC 1.04 x 10-5 5.18 x 10-7 00 : 08 : 34 : 00 100000000 MC 1.04 x 10-5 1.64 x 10-7 01 : 26 : 00 : 00 1000000000 MC 1.02 x 10-5 5.13 x 10-8 14 : 26 : 08 : 00

Table 3. Estimation of PFDavg(8760) with GRIF (Petri) In conclusion, the numerical results observed in this last section are promising about the performance of the proposed acceleration method. Further, its implementation within the MOCA-RP engine should offer yet more interesting characteristics, since the resulting optimization should reduce even more the associated computing time. Last, from an industrial point of view, let us conclude that the considered HIPS has the highest safety integrity level. Indeed, according to the norm (IEC 61508, 2005), its SIL is of 4, since PFDavg(t) < 10-4.

5 Conclusion Through this study, we have examined the feasibility and relevance of the proposed acceleration methods on the basis of an application to an industrial case. From a practical point of view, they can be used by subsystem and recombined easily. Moreover, they provide better results than MC in terms of accuracy and computing times. We here draw our conclusions on the underlined salient features. On the one hand, we have observed that, for a prescribed level of accuracy, the number of simulations to be performed by subsystem can be adapted in order to reduce the overall computational cost. Nonetheless, even though such an approach is empirical and no specific procedure has been defined, the choice of the number of simulations to be launched for each fast MC method employed by subsystem might be based on the following observation. In practice, RQMC+EMCT requires a fewer number of simulations compared to RQMC+FEM to achieve convergence, and more precisely, the results tend to indicate that at least 100 times less simulations can be considered with RQMC+EMCT. On the other hand, the study carried out with the module Petri has allowed us to observe the program optimization achieved by MOCA-RP as regards standard MC simulation in comparison with our R-programs. However, in spite of the absence of optimization of our algorithms, the numerical experiments appear to be relevant, since our proposed acceleration method provide similar accuracy results to those given by Petri while achieving a reduction of up to 75% of the computing time. Therefore, the benefit offered by the suggested acceleration methods without any optimization compared to the industrial software MOCA-RP tends to highlight their potential for rare event simulation, in particular in the framework of safety studies. We can conclude that the results are promising as for their implementation within GRIF, whose performance should be even more attractive. 6 Bibliography Bently Nevada (2002). Functional Safety and Safety Integrity Levels. M. Estécahandy (2016). Méthodes accélérées de la simulation de Monte-Carlo pour la simulation d'événements rares. Applications aux Réseaux de Petri. Ph.D. thesis, Université de Pau et des Pays de l’Adour. M. Estécahandy, L. Bordes, S. Collas and C. Paroissin (2015). Some acceleration methods for Monte Carlo simulation of rare events. Reliabity Engineering and System Safety, 144: 296-310. M. Estécahandy, L. Bordes, S. Collas and C. Paroissin (2016). Truncated Fixed Effort Method with application to dependability. Submitted. IEC 61025 (2006). Fault tree analysis (FTA), International Electrotechnical Commission, Geneva. IEC 61165 (2006). Application of Markov techniques, International Electrotechnical Commission, Geneva. IEC 61508 (2005). Functional safety of electrical/electronic/programmable electronic safety-related systems, International Electrotechnical Commission, Geneva. IEC 62551 (2012). Analysis techniques for dependability - Petri net techniques, International Electrotechnical Commission, Geneva. J.P. Signoret, Y. Dutuit and A. Rauzy (2008). High Integrity Protection Systems (HIPS): Methods and tools for efficient Safety Integrity Levels (SIL) analysis and calculations. Risk, Reliability and Societal Safety, 663-669. TOTAL (2014). GRIF: GRaphiques Interactifs pour la Fiabilité, Pau, France. [http://grif-workshop.fr] TOTAL (2015). OREDA: Offshore and Onshore REliability DAta, Pau, France. https://www.oreda.com


http://www.sciencedirect.com/science/journal/09518320

http://www.sciencedirect.com/science/journal/09518320

http://grif-workshop.fr/

https://www.oreda.com/

application of some new fast monte carlo methods to an

Documents